How to install nodejs in CentOS ?

If you choose default yum install of nodejs you will get 6.x release which is very old.
To install latest version of nodejs in centos you can execute below command
Command 1

  
  	curl -sL https://rpm.nodesource.com/setup_14.x | sudo bash -
   

You will get output as below

[vagrant@localhost ps-sinonjs]$ curl -sL https://rpm.nodesource.com/setup_14.x | sudo bash -

## Installing the NodeSource Node.js 14.x repo...


## Inspecting system...

+ rpm -q --whatprovides redhat-release || rpm -q --whatprovides centos-release || rpm -q --whatprovides cloudlinux-release || rpm -q --whatprovides sl-release
+ uname -m

## Confirming "el7-x86_64" is supported...

+ curl -sLf -o /dev/null 'https://rpm.nodesource.com/pub_14.x/el/7/x86_64/nodesource-release-el7-1.noarch.rpm'

## Downloading release setup RPM...

+ mktemp
+ curl -sL -o '/tmp/tmp.KNA1QsAK2D' 'https://rpm.nodesource.com/pub_14.x/el/7/x86_64/nodesource-release-el7-1.noarch.rpm'

## Installing release setup RPM...

+ rpm -i --nosignature --force '/tmp/tmp.KNA1QsAK2D'

## Cleaning up...

+ rm -f '/tmp/tmp.KNA1QsAK2D'

## Checking for existing installations...

+ rpm -qa 'node|npm' | grep -v nodesource

## Run `sudo yum install -y nodejs` to install Node.js 14.x and npm.
## You may also need development tools to build native addons:
     sudo yum install gcc-c++ make
## To install the Yarn package manager, run:
     curl -sL https://dl.yarnpkg.com/rpm/yarn.repo | sudo tee /etc/yum.repos.d/yarn.repo
     sudo yum install yarn

Your main instructions are here

## Run `sudo yum install -y nodejs` to install Node.js 14.x and npm.
## You may also need development tools to build native addons:
     sudo yum install gcc-c++ make
## To install the Yarn package manager, run:
     curl -sL https://dl.yarnpkg.com/rpm/yarn.repo | sudo tee /etc/yum.repos.d/yarn.repo
     sudo yum install yarn

I mean simply after executing command1 you can execute below commands and it will install latest Node.js version for you.

 sudo yum install -y nodejs 
 sudo yum install gcc-c++ make
 curl -sL https://dl.yarnpkg.com/rpm/yarn.repo | sudo tee /etc/yum.repos.d/yarn.repo
 sudo yum install yarn

Hope it helps.
Thank you for reading the article.

Firewalld: Add Puppet master ports to firewalld in CentOS7.

1. Find out what are your server's active zones.

[root@vihitaatma ~]# firewall-cmd --get-active-zones
public
  interfaces: ens192
[root@vihitaatma ~]#

2 Puppet has different ports for different services.

3000: Web based installer 

8140: Communication port between Puppet Master & Agent. 

61613: Used by MCollective for orachestration requests by Puppet agents

443: Puppet Enterprise console web port.

5432: PostgreSQL 

8081: Puppet DB Request Port.

8142: Used by Orachestration services to accept inbound traffic/responses from Puppet Agents  

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --add-port=8140/tcp

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --add-port=61613/tcp

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --add-port=443/tcp

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --add-port=5432/tcp

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --add-port=8081/tcp

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --add-port=8142/tcp

success

[root@vihitaatma ~]# sudo firewall-cmd --reload

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --list-ports

 8140/tcp 61613/tcp 443/tcp 5432/tcp 8081/tcp 8142/tcp

3. And To Remove Ports

[root@vihitaatma ~]# firewall-cmd --zone=public --remove-port=3000/tcp

success

[root@vihitaatma ~]# firewall-cmd --runtime-to-permanent

success

[root@vihitaatma ~]# firewall-cmd --reload

success

[root@vihitaatma ~]# firewall-cmd --zone=public --permanent --list-ports

8140/tcp 61613/tcp 443/tcp 5432/tcp 8081/tcp 8142/tcp

[root@vihitaatma ~]#

Root CA and Wildcard Certificate Generation in CentOS/RHEL 6&7

     Hi folks ! this is one of the best method to create your own RootCA server and generating self-signed wildcard certificates.The greatest advantage of following this method: this would not make any system level changes, as everything is stored in files mentioned in the commands. At any stage if something went wrong, clear all the files and perform the steps once again.

There are two sections

1. RootCA Server   --  Need to perform only once.

2. Generating wildcard certificates for xyz.com domain -- Need to perform once per domain to create wildcard certificates. Need to perform once per site per domain to create individual certificates per site.


RootCA Server
============
1. Install required packages.

# yum install openssl -y

2. Generate XYZRootCA certificates

# mkdir /opt/XYZRootCA
# cd /opt/XYZRootCA
# openssl genrsa -out XYZRootCA.key 2048
# openssl req -x509 -new -nodes -key XYZRootCA.key -sha256 -days 10950 -out XYZRootCA.pem

#Provide information as given below

Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Karnataka
Locality Name (eg, city) [Default City]:Bengaluru
Organization Name (eg, company) [Default Company Ltd]:XYZ Solutions Pvt. Ltd
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:XYZRootCA
Email Address []:info@xyz.com

3. Convert .pem to .crt

# openssl x509 -outform der -in XYZRootCA.pem -out XYZRootCA.crt



Generating wildcard certificates for xyz.com domain
===========================================
1. Generate CSR for *.xyz.com

# openssl genrsa -out XYZWildcard.key 2048
# openssl req -new -key XYZWildcard.key -out XYZWildcard.csr

#Provide information as given below
Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Karnataka
Locality Name (eg, city) [Default City]:Bengaluru
Organization Name (eg, company) [Default Company Ltd]:XYZ Solutions Pvt. Ltd
Organizational Unit Name (eg, section) []:Infra Support
Common Name (eg, your name or your server's hostname) []:*.xyz.com
Email Address []:infrasupport@xyz.com

2. Using CSR generated above (As Shown in Step no:1), generate a wildcard certificate for *.xyz.com also get it signed by XYZRootCA as well.

# openssl x509 -req -in XYZWildcard.csr -CA XYZRootCA.pem -CAkey XYZRootCA.key -CAcreateserial -out XYZWildcard.crt -days 3650 -sha256

3. Import XYZRootCA.crt to trusted root certificates

# yum install ca-certificates
# update-ca-trust force-enable
# cp XYZRootCA.crt /etc/pki/ca-trust/source/anchors/
# update-ca-trust extract



References:
###########

1. https://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/
2. http://linoxide.com/security/make-ca-certificate-authority/
3. https://blog.celogeek.com/201209/209/how-to-create-a-self-signed-wildcard-certificate/
4. http://stackoverflow.com/questions/13732826/convert-pem-to-crt-and-key
5. https://serversforhackers.com/self-signed-ssl-certificates
6. http://kb.kerio.com/product/kerio-connect/server-configuration/ssl-certificates/adding-trusted-root-certificates-to-the-server-1605.html

List of virtual adapters your Virtual Linux can access

Hello ,

Its me again Raja and this time I came up with one more new post.

I have been through interesting problem.

As many of you know Virtual Box , sometimes even though we enable new adapter and configured IP in conf file it wont comes up. Everything seems fine , we have enabled adapter and configured name and IP for it but still it wont come up.

Simple solution : How many adapters your VM able to access can be easily know by using command

                             ls /sys/class/net

  In my case I have 3 adapters so it will display them

root@fresh:~# ls /sys/class/net
enp0s3  enp0s8  lo
root@fresh:~#

If you come across errors like device not found errors , try to found out how your VM identified the adapters that you have enabled.

Hope it helps.

Thank you.

Linux : full path of a file

Hello ,

Sometimes we need to have full or absolute path of file. And most of the times we used to pwd + filename manually.

But with google search I came across a command named as readlink.


readlink -f filename.txt

that will print complete path of filename along with filename append to it.

linuxmen@linuxmen-fresh:~/test/test1$ readlink -f ex4.js
/home/linuxmen/test/test1/ex4.js
linuxmen@linuxmen-fresh:~/test/test1$  

Note : make sure you are same directory where file resides else give relative path to file.

Hope it helps

Suspended Jobs vs Running jobs in Linux

Background Job : A job which is running background in the same shell. You can use bg command to see any background jobs.

Foreground job : A Job which is running in the same shell right before your eyes.

Suspended Job : Its a stopped/pause job but you can resume their running.

Let me explain with example very clealy

virt00# sleep 180
^Z
zsh: suspended  sleep 180
virt00# jobs
[1]  + suspended  sleep 180
virt00# bg
[1]  + continued  sleep 180
virt00# fg
[1]  + running    sleep 180
^Z
zsh: suspended  sleep 180
virt00# jobs
[1]  + suspended  sleep 180
virt00#

I have started a Job named sleep 180 then I stopped with CTRL+Z . right now my job is in suspended mode.

I see it by typing jobs command. Now I want to resume its running in background so I typed bgcommand then it will move from suspended state to running state but in background it will run.

now I typed command fg to bring it foreground , now job wont get stepped but it will pull from background jobs queue and push into foreground jobs queue.

So yes background jobs and foreground jobs always are in running state.

Deny SSH access to particular users

We all know SSH is very famous and the best service for remote access.

Today I am going to tell you how to block or allow only particular users or group from SSH access.

open sshd_config file as per your environment

in Debian

vim /etc/ssh/sshd_config

Then add below line to enable access for only below users

AllowUsers username1 username2

to deny access for only below users add a line as

DenyUsers username1 username2

as in the same way

AllowGroups group1 group2

and to deny groups

DenyGroups group1 group2

 But there is something very important you have to follow here. It is the order of mentioning.

From manpage of SSH 

The allow/deny directives are processed in the following
      order: DenyUsers, AllowUsers, DenyGroups, and finally
      AllowGroups.

So first mention DenyUsers and then AllowUsers then only it will works and same for DenyGroups and AllowGroups

Hope it helps.

How to see IOWAIT in Linux

Hello ,

You can use sar command.

in Ubuntu you can install it with

sudo apt-get install systat

and enable data collecting

sed -i 's/ENABLED="false"/ENABLED="true"/' /etc/default/sysstat

start service with

 

/etc/init.d/sysstat start

To see I/O latency type command as

sar 1 1

that means it will give two responses with 1 sec as interval.

Example :

root@virt01:~# sar 1 3
Linux 3.19.0-42-generic (virt01.ubuntu.com)     13/02/16        _x86_64_        (1 CPU)


12:26:23        CPU     %user     %nice   %system   %iowait    %steal     %idle
12:26:24        all      0.00      0.00      0.00      0.00      0.00    100.00
12:26:25        all      0.00      0.00      0.99      0.00      0.00     99.01
12:26:26        all      2.02      0.00      0.00      0.00      0.00     97.98
Average:        all      0.67      0.00      0.33      0.00      0.00     99.00
root@virt01:~#

Hope that helps.

grep: unknown device method

Today while using grep command via rundeck I was through grep: unknown device method error.

And the reason is due to I am having ' - ' in my search pattern I was through this error.

I mean search includes

grep "-search.this" /path/to/file

Then you may get error with grep. So remove ' - ' in pattern and repeat your search.

grep "search.this" /path/to/file

Hope that helps.

Uploading files to FTP/SFTP using CURL

Hello,

Today I am writing below article which can help you to upload files to SFTP/FTP by using CURL.

Ok why we need that ? Let me tell explain!!

How we login into SFTP/FTP ?

[root@virt03 test]# sftp 192.168.56.110
Connecting to 192.168.56.110...
root@192.168.56.110's password:
sftp> ls
anaconda-ks.cfg       nodes                 post-install          post-install.log

sftp> exit

and uploading files with put command. Its a lengthy way. So recently I have gone through few articles and with some R&D I have modified it as script and command-line argument support.So you can call the script with filename as argument. 

So Lets do this!!!

1. Command 1 : This is for uploading a single to SFTP/FTP by using CURL. 

SFTP

curl -k  -u virt03:virt03 -T file4  sftp://192.168.56.110/home/virt03/

Syntax : 

curl -k  -u username:password -T filename sftp://IP_Addreess OR Hostname:/path/to/upload 

FTP

curl -k  -u virt03:virt03 -T file6  ftp://192.168.56.110

Example

[root@virt03 test]# curl -k  -u virt03:virt03 -T file4  sftp://192.168.56.110/home/virt03/

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

[root@virt03 test]# touch file6

[root@virt03 test]# curl -k  -u virt03:virt03 -T file6  ftp://192.168.56.110

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

[root@virt03 test]# ls /home/virt03/ | grep file

file1

file2

file3

file4

file5

file6

[root@virt03 test]#

So hope you understand whats happening now. Lets make some script!!! 

[root@virt03 test]# ls

file1  file3  file5  file7  file9  lab2.sh     upload1.sh

file2  file4  file6  file8  lab1   rackspace3  upload2.sh

[root@virt03 test]# ls /home/virt03/ | grep file

file1

file2

file3

file4

file5

file6

[root@virt03 test]# ./upload1.sh file7

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

[root@virt03 test]# ls /home/virt03/ | grep file

file1

file2

file3

file4

file5

file6

file7

[root@virt03 test]# ./upload2.sh file8 file9

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

[root@virt03 test]# ls /home/virt03/ | grep file

file1

file2

file3

file4

file5

file6

file7

file8

file9

[root@virt03 test]# 

And the scripts are 

[root@virt03 test]# tail upload*

==> upload1.sh <==

#!/bin/bash




curl -k  -u virt03:virt03 -T "{$1}" sftp://192.168.56.110/home/virt03/




==> upload2.sh <==

#!/bin/bash

curl -k  -u virt03:virt03 -T "{$1,$2}" sftp://192.168.56.110/home/virt03/

[root@virt03 test]#

I hope you can understand what the scripts are doing. To upload more than 2 files you can use for loop like below.

for i in file1 file2 file3 file4 file5

do

./upload1.sh $i

done

Example: 

[root@virt03 test]# for i in file10 file11 file12

> do

> ./upload1.sh $i

> done

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0




[root@virt03 test]# ls /home/virt03/ | grep file1

file1

file10

file11

file12

[root@virt03 test]#

Hope you understand!! , If any doubts please dont hesitate to ask.

List the installed RPMs by date of installation in CentOS/RHEL 6.x

How to list  the installed packages on date wise

Command is : 

#rpm -qa --qf '%{INSTALLTIME} (%{INSTALLTIME:date}): %{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -n

How To Configure VSFTPD With TLS/SSL On RHEL/CentOS 6.x and How To Connect Secure VSFTPD(TLS/SSL) in Heterogeneous Environments Using Client Programs. (Part..A)

Traditional FTP is rather insecure. When you login, your username and password are transmitted in clear text, raising the possibility of your credentials being 'sniffed' by a malicious person. Fortunately there's an easy answer to this. You can quite easily configure your vsftpd server to use OpenSSL encryption, so that usernames & password, and even data files, are encrypted during transfer. It takes just a few simple steps: 

Vsftpd is already available under CentOS/RHEL  default repositories. We assume that CentOS/RHEL users have enabled default repositories in his system. Now execute following command. 

Note:- This post works with Security-Enhanced Linux (SELinux) is enabled  

Installing and Configuring the Vsftpd in RHEL/CentOS 6.x 

Step1:-  Install VsFTPd 

# yum install vsftpd 

Step2:-  Configure Basic VsFTPd Settings 

Now Edit Vsftpd configuration file /etc/vsftpd/vsftpd.conf in CentOS/RHEL and do the some basic settings like below. If you are configuring FTP for private users then we strictly advice to disable anonymous login. 

Before editing any configuration file please maintain a backup. Its good practice 

# cp -a /etc/vsftpd/vsftpd.conf_bkp /etc/vsftpd/vsftpd.conf 

1. Allow anonymous FTP? Set this value to NO to disable anonymous login. default value is YES 

• anonymous_enable=NO  

2. Uncomment below line to allow local system users to log in via ftp 

• local_enable=YES 

3. Uncomment below line to enable any form of FTP write command like, creating or uploading files and directory. 

• write_enable=YES 

3. Uncomment below line to enable local system users to permit  their home directory only. 

• chroot_local_user=YES 

Note : - While using chroot_local_user=YES  you must set user default shell as /sbin/nologin Otherwise ftp users can gain the access to ssh login 

Now start the vsftpd service  

# service vsftpd start 

To check the vsftpd service running or not 

# service vsftpd status 

To check the vsftpd service running port 

# netstat -nptelu | grep vsftpd 

Step3:-  First load the following module to make sure passive ftp connections are not rejected and also allow the port 

Open the following file /etc/sysconfig/iptables-config and change IPTABLES_MODULES=" " to IPTABLES_MODULES="ip_conntrack_ftp"  

Make sure ftp port is allowed in iptables. 

# iptables -L --line-number -n  

Now restart the iptables and vsftpd service  

# service iptables restart && service vsftpd restart  

Step4:- Create user and check the login 

# useradd -s /sbin/nologin test 

# passwd test 

Now use FileZilla client software to check. Because it will give exact issue if any problem 

I think SELinux will prevent while switching to the home directory. the error like below 

 

Now you have to allow the polices in selinux. 

# setsebool -P ftp_home_dir 1 

# setsebool -P allow_ftpd_full_access 1 

Till now we are done with basic vsftpd installation and configuration. Now we are going to configure TLS/SSL. 

Configuring the TLS/SSL  

Step5:-  Make sure openssl package is installed on machine. Here we are securing vsftpd by using self signed certificates 

Please follow the below steps for generating self signed certificates 

#openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/vsftpd/vsftpdkey.pem -out /etc/vsftpd/vsftpd.pem 

In "Common Name (eg, your name or your server's hostname)" part give proper domain name otherwise use wildcards Ex: *.google.com, *.xyz.com 

Then change the permissions to these certificate files 

# chmod 400 /etc/vsftpd/vsftpd.pem 

# chmod 400 /etc/vsftpd/vsftpdkey.pem 

Step6:- Securing the ftp can be done by two ways. 

1) Implicit SSL of vsftp (Port 990) 

2) Explicit TLS of vsftp (Port 21) 

1) Implicit SSL of vsftp (Port 990) 

In this method client must use SSL to connect using the port number 990. 

Follow the below configuration details. 

Open vsftpd file /etc/vsftpd/vsftpd.conf  add below lines in end of this file 

#ssl/tsl enable 

rsa_cert_file=/etc/vsftpd/vsftpd.pem 

rsa_private_key_file=/etc/vsftpd/vsftpdkey.pem 

ssl_enable=YES 

allow_anon_ssl=NO 

force_local_data_ssl=YES 

force_local_logins_ssl=YES 

ssl_tlsv1=YES 

ssl_sslv2=NO 

ssl_sslv3=NO 

require_ssl_reuse=NO 

ssl_ciphers=HIGH 

 #Implicit SSL Configuration 

implicit_ssl=YES 

listen_port=990 

# Pasive ftp enable (These ports are up to you ) 

pasv_min_port=2100 

pasv_max_port=2200 

# Ftp Loging 

xferlog_file=/var/log/vsftpd.log 

xferlog_enable=YES 

dirmessage_enable=YES 

xferlog_std_format=NO 

data_connection_timeout=600 

dual_log_enable=YES 

log_ftp_protocol=YES 

debug_ssl=YES 

Save and Exit the file 

#service vsftpd restart 

To check the vsftpd service running port 

# netstat -nptelu | grep vsftpd 

Note:- Allow the ports 2100 to 2200 in iptables (These ports are up to you ) 

2) Explicit TLS of vsftp (Port 21) 

In this method client can send the connection using default port only( Port 21). 

Follow the below configuration details. 

Open vsftpd file /etc/vsftpd/vsftpd.conf  add below lines in end of this file 

#ssl/tsl enable 

rsa_cert_file=/etc/vsftpd/vsftpd.pem 

rsa_private_key_file=/etc/vsftpd/vsftpdkey.pem 

ssl_enable=YES 

allow_anon_ssl=NO 

force_local_data_ssl=YES 

force_local_logins_ssl=YES 

ssl_tlsv1=YES 

ssl_sslv2=NO 

ssl_sslv3=NO 

require_ssl_reuse=NO 

ssl_ciphers=HIGH 

#Explicit TLS Configuration 

#implicit_ssl=YES 

#listen_port=990 

# Pasive ftp enable(These ports are up to you ) 

pasv_min_port=2100 

pasv_max_port=2200 

# Ftp Loging 

xferlog_file=/var/log/vsftpd.log 

xferlog_enable=YES 

dirmessage_enable=YES 

xferlog_std_format=NO 

data_connection_timeout=600 

dual_log_enable=YES 

log_ftp_protocol=YES 

debug_ssl=YES 

Save and Exit the file 

#service vsftpd restart 

To check the vsftpd service running port 

# netstat -nptelu | grep vsftpd 

Note:- Allow the ports 2100 to 2200 in iptables ( These ports are up to you )